CVE-2026-106700: n/a

CVE-2026-106700 describes an improper access control vulnerability in ELADMIN v2.7 and earlier. The vulnerability exists in the PUT /api/users/resetPwd endpoint of the UserController, which does not enforce method-level authorization or role/ownership validation in the UserServiceImpl.resetPwd method. As a result, any authenticated user, regardless of role, can reset the password of any user, including the administrator, potentially leading to full account takeover.

An attacker with any authenticated user credentials can reset passwords for arbitrary users, including the built-in administrator. This can lead to unauthorized account takeover, privilege escalation, and full system compromise. The CVSS 3.1 score is 8.8 (High), reflecting the ease of exploitation and the critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint and monitor for unauthorized password reset attempts. Implement additional access controls or role validation on the resetPwd endpoint to prevent unauthorized use.